The problem is one of the restricted websites is used to access an application from a Citrix server. When anyone in the restricted group tries to use this application, it will not run and displays a message "This Citrix sever is not accepting connections right now". Anyone in the unrestricted group can run the app just fine. Why is this? How can I get the Citrix app to work for the restricted group?

All Internet users are running the firewall client by the way.

Thanks for any advice.

MS

I'm not exactly clear on how the clients are accessing the application through the web server. Do they have to connect to the web server in order to access the application, and then after they connect they can use the application?

Is there a Site or Content rule that is preventing access to this server?

Tom

------------------
Tom Shinder
http://www.isaserver.org/shinder/

Get it Here!

People access the app by going to our customers URL: www.apps.domain.org. They then login through an SSL connection to get to the page where they select an icon to launch one of two Citix apps. Every users browser contains the Citrix ICA Web Client plugin which allows them to run the apps. The application is launched when one of the icons is selected.

The Site and Content rule for the restricted users uses a destination set that allows *.domain.org to be accessed by a certain group of users. The only other Site and Content rule I have setup is the default "Allow All" rule.

The Citrix app works fine for the group defined in the "Allow All" rule, but does not work for the group defined in the restricted content rule.

Thanks,
Mike

P.S. Your book has been a great resource!

If there is a path statement in the site and content rule, that can create issues if you have denied access to an SSL site using a path, but it doesn't sound liket that's the problem.

In the Site and Content rule, try making a rule for www.apps.domain.org and see if that works. If that works, then try *.apps.domain.org.

Let us know how it works for you!

P.S. Thanks for the kind words about the book!

Tom

------------------
Tom Shinder
http://www.isaserver.org/shinder/

Get it Here!

I tried your suggestions, but neither of them seemed to work. Do you have any other ideas?

Thanks,
Mike

Hmmm. Can you give the specific details of the Site and Content Rules you have on the machine? (change domain name to protect the innocent)

Thanks!

Tom

------------------
Tom Shinder
http://www.isaserver.org/shinder/

Get it Here!